So a diceware-style passphrase of six random words is around 80 bits, and for 128 I would need about ten words in my passphrase, right?

I tend to have a significantly easier time recalling a six-word passphrase than ten. So by your logic, key stretching makes sense in my case, am I following you correctly? Or is my math off?

(I quite enjoyed your article, thanks!)